Circumventing the Java language rules via reflection isn't "really" mutability. By that measure immutability is impossible in the JVM.
If your app was running under a security manager it would fail in runtime in any version of the JVM which is why String is immutable. This is actually enforced by the TCK since string mutability can be used for various attacks by untrusted code.
Markos Korvesis
Software Engineer
Interesting find, however, I agree with Shai Almog.
Reflection API will grant you access to do various things, but that does not mean that the language's rules are debunked, nor does it make it ok to do said things.